022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36 | Triage

Analysis

max time kernel
131s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 01:54

Sharing

Report Analysis Logs

General

Target

AMI/spoof.bat
Size

57B
MD5

70c372a580ee13ad16ff67d3cc0ff0c6
SHA1

7e92af45a827b70404573f9f8339b2c9297793ec
SHA256

74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
SHA512

8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4400	3352	cmd.exe	90
PID 3352 wrote to memory of 4400	3352	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
  AMIDEWINx64.exe /SU AUTO
  2⤵
  PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
1⤵
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads